New PCPJack Worm Targets Docker, Kubernetes, Redis, and MongoDB for Credential Theft

PCPJack is a sophisticated cloud-targeting worm and credential stealer that scans Common Crawl hostnames to discover exposed Docker, Kubernetes, Redis, MongoDB and other services, exploits multiple public CVEs to gain access, harvests SSH keys, API tokens, database credentials and wallet files, encrypts exfiltrated data with X25519/ChaCha20-Poly1305 and sends it via Telegram, and deploys multi-architecture Sliver backdoors for persistence; the report from SentinelOne includes detailed technical analysis, IoCs, and recommended mitigations such as enforcing MFA and securing container and cloud APIs.